Introduction to Computer & Networking Security Dr. Guofei Gu

Some Bedtime Stories

Denial of Service

Your YouTube Traffic: Pwned!

Phishing Spam: 95+% of all traffic on the Internet (200 billion spam messages per day, as of January 2009) Unique phishing attacks rose 13% (to over 28k!) in for second quarter hijacked brands 442 unique malicious application variants in May 2008

Malware

More… “Attack of the tweets: Major Twitter Flaw Exposed” – UK researcher says vulnerability in Twitter API lets an attacker take over a victim’s account – with a tweet. Aug 27, 2009 [Darkreading] Conficker worm:

Botnet – New Rising Threat

Sea-Change in Internet Attacks Computers on the Internet used to be mere targets –For fun and fame Now they are Resources/Platforms –For profit How big is the problem now? Introduction Botnet Detection Summary

Introduction Botnet Detection Summary Source:

Storm Worm for Comparison “…the Storm cluster has the equivalent of one to 10 million 2.8 GHz Pentium 4 processors with one to 10 million petabytes worth of RAM.... To put the size of a petabyte into perspective, Google, as of Aug. 2007, uses between 20 and 200 petabytes of disk space,according to Wikipedia.com. In comparison, Gutmann said, BlueGene/L currently contains 128,000 computer processor cores, and has a paltry 32 terabytes of RAM. A terabyte is about 1,000 times smaller than a petabyte.” Brian Kreb’s WashingtonPost report ( orm_worm_dwarfs_worlds_top_s_1.html) Introduction Botnet Detection Summary

What is Storm? A malware instance, more precisely, a botnet Using P2P techniques for its C&C channels Mainly used to send spam We are lucky because Storm is mainly used for sending spam… Introduction Botnet Detection Summary

Botnets: Current Single largest Internet Threat “Attack of zombie computers is growing threat” (New York Times) “Why we are losing the botnet battle” (Network World) “Botnet could eat the internet” (Silicon.com) “25% of Internet PCs are part of a botnet” (Vint Cerf) Introduction Botnet Detection Summary

What are Bots/Botnets? Bot (Zombie) –Compromised computer controlled by botcode (malware) without owner consent/knowledge –Professionally written; self-propagating Botnets (Bot Armies): Networks of bots controlled by criminals –Definition: “A coordinated group of malware instances that are controlled via C&C channels”. –Architectures: centralized (e.g., IRC,HTTP), distributed (e.g., P2P) –Key platform for fraud and other for-profit exploits bot C&C Bot-master Introduction Botnet Detection Summary

Botnet Epidemic More than 95% of all spam All distributed denial of service (DDoS) attacks Click fraud Phishing & pharming attacks Key logging & data/identity theft Distributing other malware, e.g., spyware Anonymized terrorist & criminal communication Introduction Botnet Detection Summary

Number of Bots Are Increasing! Introduction Botnet Detection Summary Source: shadowserver.org, 2008

Internet Security: Broken Assumptions Internet infrastructure (e.g., DNS, BGP) is trustworthy –DNS is more vulnerable than you think … Computers are secure when using up-to-date AV tools and firewall –Not really Attackers are for fun and fame –Profit, profit, profit! Attackers have limited/bounded computing power –They hare almost unbounded(?) power Attacks from isolated computers –The network is attacking you Where are we? Any hope to win this game? Introduction Botnet Detection Summary

Security (Very) Basics

What is Security? [Informally] Security is the prevention of certain types of intentional actions from occurring –These potential actions are threats –Threats that are carried out are attacks –Intentional attacks are carried out by an attacker –Objects of attacks are assets

Security: Definition Security is a state of well-being of information and infrastructures in which the possibility of successful yet undetected theft, tampering, and disruption of information and services is kept low or tolerable Security rests on confidentiality, authenticity, integrity, and availability

Basic Components Confidentiality is the concealment of information or resources Keeping data and resources hidden. Privacy. Authenticity is the identification and assurance of the origin of information Integrity refers to the trustworthiness of data or resources in terms of preventing improper and unauthorized changes Preventing unauthorized changes to data or resources. Availability refers to the ability to use the information or resource desired Enabling access to data and resources

Security Threats and Attacks A threat is a potential violation of security –Flaws in design, implementation, and operation An attack is any action that violates security –Active vs. passive attacks

Vulnerabilities (Attack Vectors) A vulnerability is a systematic artifact that exposes the user, data, or system to a threat –E.g., buffer-overflow, WEP key leakage What is the source of a vulnerability? –Bad software (or hardware) –Bad design, requirements –Bad policy/configuration –System Misuse –Unintended purpose or environment E.g., student IDs for liquor store

Eavesdropping - Message Interception (Attack on Confidentiality) Unauthorized access to information Packet sniffers and wiretappers Illicit copying of files and programs A B Eavesdropper

Full Packet Capture (Passive) Example: OC3Mon Rack-mounted PC Optical splitter Data Acquisition and Generation (DAG) card Source: endace.com

Eavesdropping Attack: Example tcpdump with promiscuous network interface –On a switched network, what can you see? What might the following traffic types reveal about communications? –DNS lookups (and replies) –IP packets without payloads (headers only) –Payloads

Integrity Attack - Tampering Stop the flow of the message Delay and optionally modify the message Release the message again A B Perpetrator

Authenticity Attack - Fabrication Unauthorized assumption of other’s identity Generate and distribute objects under this identity A B Masquerader: from A

Man-In-The-Middle: Example Passive tapping –Listen to communication without altering contents. Active wire tapping –Modify data being transmitted –Example: userintruderserver fine! X logoff! Intruder takes over identity of user (masquerading)

Attack on Availability Destroy hardware (cutting fiber) or software Modify software in a subtle way (alias commands) Corrupt packets in transit Blatant denial of service (DoS): –Crashing the server –Overwhelm the server (use up its resource) A B

Goals of Security Prevention –Prevent attackers from violating security policy Detection –Detect attackers’ violation of security policy Recovery –Stop attack, assess and repair damage Survivability –Continue to function correctly even if attack succeeds

My Overall Research Problems How to make our computer, network, and Internet more secure? Prevent Detect React/ Survive Security principles: Defense–in-Depth, layered mechanisms

Want to know more? Consider taking CSCE 465 “Computer & Network Security” next spring that I’ll teach. Interested in learning/participating in cyber security research? Talk to me after the class – –Rm 502C HRBB